Stocks● Neutral
Why Engineers Are Pushing for a Cyber Safety License
The Cyber Safety Summit tackled a central question: who is accountable when a connected physical system is compromised? Engineers and policymakers are debating a new licensed discipline to manage the risk before a catastrophe forces the issue.
Continue with
The Cyber Safety Summit held June 10 at the National Academy of Sciences in Washington, D.C., tackled a question that lacks a clear answer: who is professionally and legally accountable when a connected physical system is compromised? Cyber-physical risk, the summit made clear, is a life safety threat. No recognized engineer of record exists for it. No cyber safety standard of care has been codified.
That gap drove the summit's central debate. A growing number of engineers, insurers and policymakers argued for a new discipline – cyber safety engineering – to manage foreseeable hazards before they produce a catastrophe.
Engineering standards have historically been reactive. In the mid-1800s, fatal boiler explosions across America occurred almost every four days until a novel insurance product linked to quality inspection was established, eventually leading to the American Society of Mechanical Engineers boiler and pressure vessel code. The Great Chicago Fire killed roughly 300 people and destroyed 17,000 buildings, leading to building fire codes. The 1907 collapse of the Quebec Bridge, which killed 75 ironworkers due to a calculation error and engineering inexperience, helped establish the professional engineer as a guardian of public safety. Wyoming passed the first engineering licensure law in 1907; other states quickly followed.
John Kliem, director of federal strategy at Johnson Controls, expressed concern about following that pattern. “What scares me, is are we going to have to have a Pearl Harbor-level cybersecurity event to have more visibility?” he asked. Brian May, president of federal programs at Michael Baker International, agreed. “If a single incident causes a mass casualty event, our profession will be scrambling to develop standards under duress,” he said. “I believe we must start thoughtfully working this problem now, before we’re forced to account for a preventable catastrophe.”
Cyber-physical systems present the same conditions that drove every prior standard: foreseeable hazards, repeatable failure modes and potentially catastrophic consequences. The 2021 Colonial Pipeline attack, in which ransomware seized monitoring and billing systems connected to physical valves and meters, is one recent example. State-sponsored intrusions into U.S. infrastructure are ongoing. The open question is whether cyber safety engineering follows the historical pattern and waits for a disaster, or whether the profession moves first.
May asserted that the profession has reached a turning point. “Connected, smart technologies are present in nearly every new or retrofitted building system,” he said. “Practically speaking, engineers can no longer meet their professional obligation to deliver safe designs without considering and taking reasonable steps to mitigate cyber risk.” David Brearley of HDR noted that, in retrospect or in litigation after a cyber-physical incident, most parties would agree that the event was foreseeable. Yet no clear standards or accountability exist.